立即与支持人员聊天
与支持团队交流

Change Auditor 7.3 - Built-in Reports Reference Guide

Introduction Built-in reports
Active Directory Federation Services AD Query All Events Authentication Services Azure Active Directory Defender Office 365 Logon Activity Skype for Business Recommended Best Practices Regulatory Compliance
FISMA (Federal Information Security Management Act)
NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A01 – User Association NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A02 – Content of Audit Records NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A03 – Auditable Events NIST SP 800-53 | Technical Controls | Accountability (Including Audit Trails) | A04 – Audit Processing NIST SP 800-53 | Technical Controls | Identification and Authentication | IA02 – Remote, Privileged Access Authentication NIST SP 800-53 | Technical Controls | Identification and Authentication | IA03 – Password Protection Mechanisms NIST SP 800-53 | Technical Controls | Identification and Authentication | IA04 – Password Life NIST SP 800-53 | Technical Controls | Identification and Authentication | IA05 – Password Content NIST SP 800-53 | Technical Controls | Identification and Authentication | IA12 – Remote Access Identification Authentication NIST SP 800-53 | Technical Controls | Identification and Authentication | IA16 – Password Management NIST SP 800-53 | Technical Controls | Logical Access Control | AC01 - Remote Access Restrictions NIST SP 800-53 | Technical Controls | Logical Access Control | AC02 - Logon Notification Message NIST SP 800-53 | Technical Controls | Logical Access Control | AC05 - Session Inactivity NIST SP 800-53 | Technical Controls | Logical Access Control | AC06 - Limited Connection Time NIST SP 800-53 | Technical Controls | Logical Access Control | AC09 - Enforcement Mechanisms NIST SP 800-53 | Technical Controls | Logical Access Control | AC10 - Automated Account Controls NIST SP 800-53 | Technical Controls | Logical Access Control | AC12 - Supervision and Review NIST SP 800-53 | Technical Controls | Logical Access Control | AC14 - Authorization Procedures NIST SP 800-53 | Technical Controls | System and Communications Protection | SP02 - Information System Partitioning NIST SP 800-53 | Technical Controls | System and Communications Protection | SP04 - Denial of Service Protection NIST SP 800-53 | Technical Controls | System and Communications Protection | SP05 - Resource Priority NIST SP 800-53 | Technical Controls | System and Communications Protection | SP06 - Boundary Protection NIST SP 800-53 | Technical Controls | System and Communications Protection | SP07 - Network Segregation NIST SP 800-53 | Technical Controls | System and Communications Protection | SP09 - Network Disconnect NIST SP 800-53 | Technical Controls | System and Communications Protection | SP11 - Trust Path NIST SP 800-53 | Technical Controls | System and Communications Protection | SP16 - Use of Encryption
GLBA (Gramm-Leach-Bliley Act) GDPR HIPAA (Health Insurance Portability and Accountability Act) Payment Card Industry SAS 70 (Statement on Auditing Standards, Service Organizations) SOX (Sarbanes-Oxley General IT Controls Evidence based on the COBIT Framework)
Security SharePoint SQL Data Level SQL Extended Events Threat Detection

All Events

All Account Lockout events
Who = All Users
What = Local User Account Locked; Local User Account Unlocked; User Account Locked; User Account Unlocked
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Active Directory Database Events
Who = All Users
What = Active Directory Database facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Active Directory events
Who = All Users
What = Active Directory subsystem
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Active Directory events including ActiveRoles/GPOADmin initiator

(Returns all Active Directory events, displaying the Initiator UserName and EventSource in the Search Results)

Who = All Users
What = Active Directory subsystem
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout Tab - Selected Columns: Initiator UserName and EventSource are added to default list
All AD Query events
Who = All Users
What = AD Query facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All ADAM (AD LDS) events
Who = All Users
What = ADAM (AD LDS) subsystem
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Change Auditor Internal Auditing events
Who = All Users
What = Change Auditor Internal Auditing facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Computer events
Who = All Users
What = Custom Computer Monitoring facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Connection Object events
Who = All Users
What = Connection Object facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All DNS events
Who = All Users
What = DNS Service facility; DNS Zone facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Domain Controller events
Who = All Users
What = Configuration Monitoring facility
Where = Domain Controller
When = Last 7 days
Origin = All domain controllers
All Domain events
Who = All Users
What = Domain Configuration facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Dynamic Access Control events
Who = All Users
What = Dynamic Access Control facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All EMC events
Who = All Users
What = EMC facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Who = All Users
What = All Event Classes
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All events in the past 24 hours
Who = All Users
What = All Event Classes
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
All Exchange events
Who = All Users
What = Exchange subsystem
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Fault Tolerance events
Who = All Users
What = Fault Tolerance facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All File System events
Who = All Users
What = Custom File System Monitoring facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All FluidFS events
Who = All Users
What = FLuidFS facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Forest Configuration events
Who = All Users
What = Forest Configuration facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All FRS events
Who = All Users
What = FRS Service facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Group events
Who = All Users
What = Member Added to Critical Enterprise Group; Member Removed from Critical Enterprise Group; Nested Member Added to Critical Enterprise Group; Nested Member Removed from Critical Enterprise Group
Custom Group Monitoring facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Group Policy events
Who = All Users
What = Group Policy Link Added to OU; Group Policy Link Removed from OU; Group Policy Link Setting Modified; Group Policy Link Added to Site; Group Policy Link Removed from Site
Group Policy Item facility; Group Policy Object facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Group Policy events including GPOADmin initiator

Returns all Group Policy events, displaying the Initiator UserName and EventSource in the Search Results

Who = All Users
What = Group Policy subsystem
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout Tab - Selected Columns: Initiator UserName and EventSource are added to default list
All IP Security events
Who = All Users
What = IP Security facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Irregular Domain Replication Activity events
Who = All Users
What = Irregular domain replication activity detected
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Irregular Domain Controller Registration events
Who = All Users
What = Irregular domain controller registration activity detected
Where = All sources
When = Last 7 days
Origin = All workstations/servers
 
All NetApp events
Who = All Users
What = NetApp facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All NETLOGON events
Who = All Users
What = NETLOGON Service facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All NTDS events
Who = All Users
What = NTDS Service facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Object Restore events
Who = All Users
What = Computer Added; Domain Added; Exchange Group Added (Exchange 2003); Group Object Added; Group Policy Object Added; Subordinate OU Added; User Object Added
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All OU events
Who = All Users
What = OU facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Registry events
Who = All Users
What = Registry subsystem
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Replication events
Who = All Users
What = Replication Transport facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Schema Configuration events
Who = All Users
What = Schema Configuration facility
Schema FSMO Role Owner Moved; Schema Modifications Allowed Flag Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Services events
Who = All Users
What = Service Monitoring facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All Site events
Who = All Users
What = Site Added; Site Removed; Site Renamed; Site Link Added; Site Link Removed; Site Link Bridge Added; Site Link Bridge Removed
Site Configuration facility; Site Link Bridge Configuration facility; Site Link Configuration facility; Subnets facility; Connection Object facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All System events
Who = All Users
What = System Events facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All SYSVOL events
Who = All Users
What = SYSVOL facility
SYSVOL Location Changed
Where = All sources
When = Last 7 days
Origin = All workstations/servers
All User events
Who = All Users
What = Custom User Monitoring facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers

Authentication Services

All Authentication Services events in last 30 days
Who = All Users
What = Authentication Monitoring facility
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Authentication Services computer object auditing in last 30 days
Who = All Users
What = Authentication Services Computer Object Added; Authentication Services Computer Object Attribute Changed; Authentication Services Computer Object Deleted; Authentication Services Computer Object Moved; Authentication Services Computer Object Renamed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Authentication Services computers added in last 30 days
Who = All Users
What = Authentication Services Computer Object Added
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Authentication Services computers deleted in last 30 days
Who = All Users
What = Authentication Services Computer Object Deleted
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Authentication Services GPO settings changes in last 30 days
Who = All Users
What = Authentication Services GPO Setting Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Groups set to UNIX-disabled in last 30 days
Who = All Users
What = UNIX-Enabled Changed for Group - Restriction = To: Disabled
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Groups set to UNIX-enabled and created in last 30 days
Who = All Users
What = UNIX-Enabled Changed for Group; UNIX-Enabled Group Created
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Groups set to UNIX-enabled in last 30 days
Who = All Users
What = UNIX-Enabled Changed for Group - Restriction = To: Enabled
Where = All sources
When = Last 30 days
Origin = All workstations/servers
NIS object auditing in last 30 days
Who = All Users
What = NIS Object Added; NIS Object Attribute Changed; NIS Object Deleted; NIS Object Moved; NIS Object Renamed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Personality object auditing in last 30 days
Who = All Users
What = Personality Object Added; Personality Object Attribute Changed; Personality Object Deleted; Personality Object Moved; Personality Object Renamed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
UNIX home directory changed in last 30 days
Who = All Users
What = UNIX Home Directory Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
UNIX login shell changed in last 30 days
Who = All Users
What = UNIX Login Shell Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
UNIX-enabled groups created in last 30 days
Who = All Users
What = UNIX-Enabled Group Created
Where = All sources
When = Last 30 days
Origin = All workstations/servers
UNIX-enabled groups deleted in last 30 days
Who = All Users
What = UNIX-Enabled Group Deleted
Where = All sources
When = Last 30 days
Origin = All workstations/servers
UNIX-enabled users created in last 30 days
Who = All Users
What = UNIX-Enabled User Created
Where = All sources
When = Last 30 days
Origin = All workstations/servers
UNIX-enabled users deleted in last 30 days
Who = All Users
What = UNIX-Enabled User Deleted
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Users set to UNIX-disabled in last 30 days
Who = All Users
What = UNIX-Enabled Changed for User - Restriction = To: Disabled
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Users set to UNIX-enabled and created in last 30 days
Who = All Users
What = UNIX-Enabled Changed for User; UNIX-Enabled User Created
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Users set to UNIX-enabled in last 30 days
Who = All Users
What = UNIX-Enabled Changed for User - Restriction = To: Enabled
Where = All sources
When = Last 30 days
Origin = All workstations/servers

Azure Active Directory

All Azure Active Directory application events in the past 7 days
What = Azure Active Directory - Application facility
When = Last 7 days
Layout tab - Order By: Time Detected (Not Grouped)
All Azure Active Directory directory events in the past 7 days
What = Azure Active Directory - Directory facility
When = Last 7 days
Layout tab - Order By: Time Detected (Not Grouped)
All Azure Active Directory events in the past 7 days
Who = All Users
What = Azure Active Directory subsystem
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped)
All Azure Active Directory events in the past 7 days by activity
Who = All Users
What = Azure Active Directory subsystem
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout tab - Order By: Time Detected, Grouped by Activity Name/Operation
All Azure Active Directory events in the past 7 days by activity type
Who = All Users
What = Azure Active Directory subsystem
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout: Order by: Time Detected, Grouped by Activity type
All Azure Active Directory events in the past 7 days by category
Who = All Users
What = Azure Active Directory subsystem
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout: Order by: Time Detected, Grouped by Category
All Azure Active Directory policy events in the past 7 days
What = Azure Active Directory - Policy facility
When = Last 7 days
Layout tab - Order By: Time Detected (Not Grouped)
All Azure Active Directory resource events in the past 7 days
What = Azure Active Directory - Resource facility
When = Last 7 days
Layout tab - Order By: Time Detected (Not Grouped)
All Azure Active Directory self-service activity events in the past 7 days
What = Azure Active Directory subsystem, Activity Name Like = *self-serv*
When = Last 7 days
Layout tab - Order By: Time Detected (Not Grouped)
All Azure Active Directory sign-ins in the last 24 hours
Who = All Users
What = Azure Active Directory – Sign-in facility
Where = All sources
When = Last 24 hours
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped)
All Azure Active Directory synchronized events in the past 7 days
What = Azure Active Directory subsystem, Activity Origin EQUALS AD
When = Last 7 days
Layout tab - Order By: Time Detected (Not Grouped)
All Azure Active Directory user events in the past 7 days
What = Azure Active Directory - User facility
When = Last 7 days
Layout tab - Order By: Time Detected (Not Grouped)
 
Group
All Azure Active Directory group events in the past 7 days
What = Azure Active Directory - Group facility
When = Last 7 days
Layout tab - Order By: Time Detected (Not Grouped)
Group membership changes in the last 30 days grouped by group
What: Group member added, Group member removed
When: Last 30 days
Layout tab - Order By: Time Detected (Group by: Target Display Name)
Group membership changes in the last 30 days grouped by member
What: Member added to group, Member removed from group
When: Last 30 days
Layout tab - Order By: Time Detected (Group by: Target Display Name)
Group owner changes in the last 30 days grouped by group
What: Group Owner added, Group owner removed
When: Last 30 days
Layout tab - Order By: Time Detected (Group by: Target Display Name)
Group owner changes in the last 30 days grouped by owner
What: Owner added to group, Owner removed from group
When: Last 30 days
Layout tab - Order By: Time Detected (Group by: Target Display Name)
Risky Sign-Ins
All Azure Active Directory sign-in from anonymous IP address events in the past 7 days
Who = All Users
What = Azure Active Directory – Target LIKE Sign-in from anonymous IP address
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped)
All Azure Active Directory Sign-in from confirmed compromised user events in the past 7 days
Who = All Users
What = Azure Active Directory – Target LIKE Sign-in from confirmed compromised user
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped)
All Azure Active Directory sign-in from IP address with malicious activity events in the past 7 days
Who = All Users
What = Azure Active Directory – Target LIKE Sign-in from IP address with malicious activity
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped)
All Azure Active Directory sign-in from IP address with suspicious activity events in the past 7 days
Who = All Users
What = Azure Active Directory – Target LIKE Sign-in from IP address with suspicious activity
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped)
All Azure Active Directory sign-in from malware-infected device events in the past 7 days
Who = All Users
What = Azure Active Directory – Target LIKE sign-in from malware-infected device
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped)
All Azure Active Directory sign-in risk event changes in the past 7 days
Who = All Users
What = Azure Active Directory – Risk Event facility
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped)
All Azure Active Directory sign-in with impossible travel events in the past 7 days
Who = All Users
What = Azure Active Directory – Target LIKE sign-in with impossible travel
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped)

 

All Azure Active Directory sign-in with valid credentials from blocked IP address events in the past 7 days
Who = All Users
What = Azure Active Directory – Target LIKE sign-in with valid credentials from blocked IP address
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped)
All Azure Active Directory sign-in with unfamiliar location or properties events in the past 7 days
Who = All Users
What = Azure Active Directory – Target LIKE sign-in with unfamiliar location or other properties
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped)

 

All Azure Active Directory suspicious manipulation or rules in user's inbox events in the past 7 days
Who = All Users
What = Azure Active Directory – Target LIKE suspicious manipulation or rules in user’s inbox
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped)
All Azure Active Directory user activity with known sign-in attack pattern events in the past 7 days
Who = All Users
What = Azure Active Directory – Target LIKE user activity with known sign-in attack pattern
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped)
All Azure Active Directory user activity with known attack pattern events in the past 7 days
Who = All Users
What = Azure Active Directory – Target LIKE user activity with known attack pattern
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped)
All Azure Active Directory unlikely travel between sign-in source locations events in the past 7 days
Who = All Users
What = Azure Active Directory – Target LIKE unlikely travel between sign-in source locations
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped)
All Azure Active Directory user sign-in with leaked credentials events in the past 7 days
Who = All Users
What = Azure Active Directory – Target LIKE User with leaked credential
Where = All sources
When = Last 7 days
Origin = All workstations/servers
Layout tab - Order By: Time Detected (Not Grouped)
Role
All Azure Active Directory role events in the past 7 days
What = Azure Active Directory - role facility
When = Last 7 days
Layout tab - Order By: Time Detected (Not Grouped)
Global Administrator role membership changes in the last 30 days
What = Azure Active Directory - role facility - Role member added, Role member removed, Eligible member added to role, Eligible member removed from role.
When = Last 30 days
Layout tab - Order By: Time Detected (Not Grouped)
Role membership changes in the last 30 days grouped by member
What = Azure Active Directory - role facility - Role assigned to eligible member, Role assigned to member, Roll removed from eligible member, Role removed from member
When = Last 30 days
Layout tab - Order By: Time Detected (Group by: Target Display Name)
Role membership changes in the last 30 days grouped by role
What = Azure Active Directory - role facility - Role member added, Role member removed, Eligible member added to role, Eligible member removed from role.
When = Last 30 days
Layout tab - Order By: Time Detected (Group by: Target Display Name)

Defender

All Defender events in last 30 days
Who = All Users
What = Defender facility
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Defender – Member added to access node in last 30 days
Who = All Users
What = Member Added to Access Node
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Defender – Member removed from access node in last 30 days
Who = All Users
What = Member Removed from Access Node
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Defender access node added in last 30 days
Who = All Users
What = Defender Access Node Added
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Defender access node removed in last 30 days
Who = All Users
What = Defender Access Node Removed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Defender password events in last 30 days
Who = All Users
What = Defender Password Changed; Defender Password Cleared; Defender Password Expiry Cleared; Defender Password Expiry Set; Defender Password Set
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Defender policy added in last 30 days
Who = All Users
What = Defender Policy Added
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Defender policy change events in last 30 days
Who = All Users
What = Defender Policy Changed for Access Node; Defender Policy Changed for Group; Defender Policy Changed for Security Server; Defender Policy Changed for User
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Defender policy removed in last 30 days
Who = All Users
What = Defender Policy Removed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Defender RADIUS payload added in last 30 days
Who = All Users
What = Defender RADIUS Payload Added
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Defender RADIUS payload change events in last 30 days
Who = All Users
What = Defender RADIUS Payload Changed for Access Node; Defender RADIUS Payload Changed for Group; Defender RADIUS Payload Changed for Security Server; Defender RADIUS Payload Changed for User
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Defender RADIUS payload removed in last 30 days
Who = All Users
What = Defender RADIUS Payload Removed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Defender security server added in last 30 days
Who = All Users
What = Defender Security Server Added
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Defender security server assigned to access node in last 30 days
Who = All Users
What = Defender Security Server Assigned to Access Node
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Defender security server removed in last 30 days
Who = All Users
What = Defender Security Server Removed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Defender security server unassigned from access node in last 30 days
Who = All Users
What = Defender Security Server Unassigned to Access Node
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Defender temporary response events in last 30 days
Who = All Users
What = Defender Token Temporary Response Cleared; Defender Token Temporary Response Set; Defender Token Temporary Response Usage Changed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Defender token added in last 30 days
Who = All Users
What = Defender Token Added
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Defender token assigned in last 30 days
Who = All Users
What = Defender Token Assigned
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Defender token PIN events in last 30 days
Who = All Users
What = Defender Token PIN Changed; Defender Token PIN Cleared; Defender Token PIN Expiry Cleared; Defender Token PIN Expiry Set; Defender Token PIN Set
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Defender token removed in last 30 days
Who = All Users
What = Defender Token Removed
Where = All sources
When = Last 30 days
Origin = All workstations/servers
Defender token unassigned in last 30 days
Who = All Users
What = Defender Token Unassigned
Where = All sources
When = Last 30 days
Origin = All workstations/servers
相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级